AI governance

The KYC agent uses a language model only for name pairs a deterministic check can't resolve. Exact matches never reach the model.

Recommendations below a confidence threshold are routed to human review. The agent has no automated reject path; a rejection can only come from a human reviewer.

Every output is labelled as a recommendation. The client institution retains every decision.

Every recommendation is stored with its reasoning, confidence score, model version and timestamp, and can be retrieved for audit.

The model is configured to minimise run-to-run variation, and a deterministic check runs before any model call.

We don't train or fine-tune models on client data (built today). Reviewed cases are added to our evaluation dataset, masked, only with the client's written consent (planned).

Our labeled evaluation set holds 46 examples today. Accuracy benchmarking begins once a larger, balanced dataset exists, and we'll publish the method and results then.

Model and prompt versions are tracked, and clients are told before a change affects their traffic.

Indian names vary across scripts, transliterations and regional naming conventions. Testing across these patterns is planned as part of the benchmark.

If an AI-related incident affects a client's recommendations, we notify that client without undue delay, within 72 hours of becoming aware.